It looks to me like the panic is also due to a bug in routine `eif_box' in
malloc.c.  That routine has a case for SK_REF, so it is trying to correctly
handle a reference that is passed in, but it fails because

   switch (v.type)

should be

   switch (v.type & SK_HEAD)

I noticed a couple of other places that might be incorrect in eif_rout_obj.h,
depending on how they are actually used, but I can't be sure.  These are
places that get the "type" without masking with SK_HEAD.  You should
probably examine them to be sure they are OK:

#define eif_item_sk_type(tuple,pos)             ((EIF_TYPED_VALUE *) (tuple) + pos)->type

#define eif_item_type(tuple,pos)                eif_sk_type_to_type_code(eif_item_sk_type(tuple,pos))

#define rout_tuple_item_copy(t,i,s,j) \
        (*((EIF_TYPED_VALUE *) (t) + i)).item = (*((EIF_TYPED_VALUE *) (s) + j)).item; \
        if (eif_item_sk_type(t,i) == SK_REF) { \
                RTAR((EIF_REFERENCE) t, eif_reference_item(s,j)); \
        }

#define eif_is_reference_tuple_item(item)       (eif_tuple_item_sk_type(item) == SK_REF)

#define eif_tuple_item_sk_type(item)            ((EIF_TYPED_VALUE *) (item))->type